Loading ...

Play interactive tourEdit tour

Windows Analysis Report uWDCUIgE95.exe

Overview

General Information

Sample Name:uWDCUIgE95.exe
Analysis ID:434896
MD5:e6c676ea92d72da7f2d79f8afc468cf5
SHA1:c52fc4b841927fd73fc018f81c72845e225ad5e7
SHA256:4a201ce6a206689701654f28999eed6731499cf7702b484cfdacd42d64e739a3
Tags:exeGuLoader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Potential malicious icon found
Yara detected GuLoader
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • uWDCUIgE95.exe (PID: 2268 cmdline: 'C:\Users\user\Desktop\uWDCUIgE95.exe' MD5: E6C676EA92D72DA7F2D79F8AFC468CF5)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "http://theater.expodium.net/wp-content/plugins/m/Host_AvQmpG228.bin, https://meatflesh.com/b/Host_AvQmpG228.bin"}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
uWDCUIgE95.exeJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmpJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
      00000001.00000000.229326880.0000000000401000.00000020.00020000.sdmpJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
        00000001.00000002.592412428.00000000021F0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          1.0.uWDCUIgE95.exe.400000.0.unpackJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security
            1.2.uWDCUIgE95.exe.400000.0.unpackJoeSecurity_GuLoader_1Yara detected GuLoaderJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Antivirus / Scanner detection for submitted sampleShow sources
              Source: uWDCUIgE95.exeAvira: detected
              Found malware configurationShow sources
              Source: uWDCUIgE95.exeMalware Configuration Extractor: GuLoader {"Payload URL": "http://theater.expodium.net/wp-content/plugins/m/Host_AvQmpG228.bin, https://meatflesh.com/b/Host_AvQmpG228.bin"}
              Multi AV Scanner detection for submitted fileShow sources
              Source: uWDCUIgE95.exeReversingLabs: Detection: 23%
              Source: uWDCUIgE95.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

              Networking:

              barindex
              C2 URLs / IPs found in malware configurationShow sources
              Source: Malware configuration extractorURLs: http://theater.expodium.net/wp-content/plugins/m/Host_AvQmpG228.bin, https://meatflesh.com/b/Host_AvQmpG228.bin
              Source: uWDCUIgE95.exe, 00000001.00000002.592279427.000000000065A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

              System Summary:

              barindex
              Potential malicious icon foundShow sources
              Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess Stats: CPU usage > 98%
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_004057151_2_00405715
              Source: uWDCUIgE95.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: uWDCUIgE95.exe, 00000001.00000000.229354305.0000000000424000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameForhaeng.exe vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exe, 00000001.00000002.592355988.00000000020F0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameForhaeng.exeFE2X2 vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exe, 00000001.00000002.592355988.00000000020F0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameForhaeng.exeFE2X vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exe, 00000001.00000002.592355988.00000000020F0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameForhaeng.exeFE2XN vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exe, 00000001.00000002.592355988.00000000020F0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameForhaeng.exeFE2X+ vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exe, 00000001.00000002.592355988.00000000020F0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameForhaeng.exeFE2Xe vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exe, 00000001.00000002.592355988.00000000020F0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameForhaeng.exeFE2XF vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exeBinary or memory string: OriginalFilenameForhaeng.exe vs uWDCUIgE95.exe
              Source: uWDCUIgE95.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
              Source: classification engineClassification label: mal100.rans.troj.evad.winEXE@1/0@0/0
              Source: uWDCUIgE95.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: uWDCUIgE95.exeReversingLabs: Detection: 23%

              Data Obfuscation:

              barindex
              Yara detected GuLoaderShow sources
              Source: Yara matchFile source: 00000001.00000002.592412428.00000000021F0000.00000040.00000001.sdmp, type: MEMORY
              Yara detected GuLoaderShow sources
              Source: Yara matchFile source: uWDCUIgE95.exe, type: SAMPLE
              Source: Yara matchFile source: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000000.229326880.0000000000401000.00000020.00020000.sdmp, type: MEMORY
              Source: Yara matchFile source: 1.0.uWDCUIgE95.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 1.2.uWDCUIgE95.exe.400000.0.unpack, type: UNPACKEDPE
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_00406055 push ss; retf 1_2_00406057
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_0040906E push es; ret 1_2_0040906F
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_00409419 push ebx; retf 1_2_0040941F
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_0040A039 pushad ; retf 1_2_0040A03B
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_00406C9C push A53AAEE7h; ret 1_2_00406CAD
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_00407566 push es; retf 1_2_00407567
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_004095C4 pushad ; iretd 1_2_004095C5
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_00409181 push cs; ret 1_2_0040918B
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_0040A199 push cs; iretd 1_2_0040A19A
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_00407DAA push es; retf 1_2_00407DAB
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_0040AE6E push ebx; ret 1_2_0040AEDD
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_0040AEDE push es; iretd 1_2_0040AEF3
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_004076E0 push es; retf 1_2_004076E7
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_004092FF push ss; ret 1_2_00409300
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_00402F13 push dword ptr [ebp-1Ch]; ret 1_2_0041B294
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeCode function: 1_2_004047AD push ebp; ret 1_2_004047AE
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Tries to detect virtualization through RDTSC time measurementsShow sources
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeRDTSC instruction interceptor: First address: 00000000021F2BC6 second address: 00000000021F2BC6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, A1F04A1Bh 0x00000007 add eax, 4C97544Ah 0x0000000c xor eax, F4F56E4Dh 0x00000011 add eax, E58D0FD9h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007FAA30938A38h 0x0000001e lfence 0x00000021 mov edx, 602BCEE6h 0x00000026 xor edx, E9EBD20Fh 0x0000002c xor edx, A543F5DAh 0x00000032 xor edx, 537DE927h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 cmp ecx, 00000000h 0x00000048 jne 00007FAA30938A0Dh 0x0000004a push dx 0x0000004c mov dx, 1DDDh 0x00000050 pop dx 0x00000052 mov dword ptr [ebp+000001FCh], esi 0x00000058 mov esi, ecx 0x0000005a push esi 0x0000005b mov esi, dword ptr [ebp+000001FCh] 0x00000061 call 00007FAA30938A8Fh 0x00000066 call 00007FAA30938A59h 0x0000006b lfence 0x0000006e mov edx, 602BCEE6h 0x00000073 xor edx, E9EBD20Fh 0x00000079 xor edx, A543F5DAh 0x0000007f xor edx, 537DE927h 0x00000085 mov edx, dword ptr [edx] 0x00000087 lfence 0x0000008a ret 0x0000008b mov esi, edx 0x0000008d pushad 0x0000008e rdtsc
              Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected

              Anti Debugging:

              barindex
              Found potential dummy code loops (likely to delay analysis)Show sources
              Source: C:\Users\user\Desktop\uWDCUIgE95.exeProcess Stats: CPU usage > 90% for more than 60s
              Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
              Source: uWDCUIgE95.exe, 00000001.00000002.592318985.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: uWDCUIgE95.exe, 00000001.00000002.592318985.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: uWDCUIgE95.exe, 00000001.00000002.592318985.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
              Source: uWDCUIgE95.exe, 00000001.00000002.592318985.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
              Source: uWDCUIgE95.exe, 00000001.00000002.592318985.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: Progmanlock

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11Input Capture1Security Software Discovery2Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery11Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.

              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              uWDCUIgE95.exe24%ReversingLabsWin32.Trojan.Graftor
              uWDCUIgE95.exe100%AviraHEUR/AGEN.1134908

              Dropped Files

              No Antivirus matches

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              1.0.uWDCUIgE95.exe.400000.0.unpack100%AviraHEUR/AGEN.1134908Download File
              1.2.uWDCUIgE95.exe.400000.0.unpack100%AviraHEUR/AGEN.1134908Download File

              Domains

              No Antivirus matches

              URLs

              No Antivirus matches

              Domains and IPs

              Contacted Domains

              No contacted domains info

              Contacted IPs

              No contacted IP infos

              General Information

              Joe Sandbox Version:32.0.0 Black Diamond
              Analysis ID:434896
              Start date:15.06.2021
              Start time:16:18:41
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 5m 58s
              Hypervisor based Inspection enabled:false
              Report type:full
              Sample file name:uWDCUIgE95.exe
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
              Number of analysed new started processes analysed:22
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • HDC enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Detection:MAL
              Classification:mal100.rans.troj.evad.winEXE@1/0@0/0
              EGA Information:Failed
              HDC Information:
              • Successful, ratio: 16.9% (good quality ratio 3.7%)
              • Quality average: 9.8%
              • Quality standard deviation: 19.4%
              HCA Information:Failed
              Cookbook Comments:
              • Adjust boot time
              • Enable AMSI
              • Found application associated with file extension: .exe
              • Override analysis time to 240s for sample files taking high CPU consumption
              Warnings:
              Show All
              • Max analysis timeout: 220s exceeded, the analysis took too long
              • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
              • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
              • Not all processes where analyzed, report is missing behavior information
              • VT rate limit hit for: /opt/package/joesandbox/database/analysis/434896/sample/uWDCUIgE95.exe

              Simulations

              Behavior and APIs

              No simulations

              Joe Sandbox View / Context

              IPs

              No context

              Domains

              No context

              ASN

              No context

              JA3 Fingerprints

              No context

              Dropped Files

              No context

              Created / dropped Files

              No created / dropped files found

              Static File Info

              General

              File type:PE32 executable (GUI) Intel 80386, for MS Windows
              Entropy (8bit):5.799875335012054
              TrID:
              • Win32 Executable (generic) a (10002005/4) 99.15%
              • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
              • Generic Win/DOS Executable (2004/3) 0.02%
              • DOS Executable Generic (2002/1) 0.02%
              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
              File name:uWDCUIgE95.exe
              File size:147456
              MD5:e6c676ea92d72da7f2d79f8afc468cf5
              SHA1:c52fc4b841927fd73fc018f81c72845e225ad5e7
              SHA256:4a201ce6a206689701654f28999eed6731499cf7702b484cfdacd42d64e739a3
              SHA512:fcebe10be9a14f209159d98cd31c3446739ce95fe5398cea6c404b3f50c99a21b2ed34bcf18764724c471a28933da8e22e6e506873e8cab150c69e9d9b7666a8
              SSDEEP:1536:mgnyQJZHxyp7dwLPEG2TAl/HPqSd46+R1rp0ghL0tET5uMCwPeY4CNQ3:Fy88d6PEZSvqO46wp0ghaET+wPiz
              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...idfU.....................0............... ....@................

              File Icon

              Icon Hash:20047c7c70f0e004

              Static PE Info

              General

              Entrypoint:0x4018a4
              Entrypoint Section:.text
              Digitally signed:false
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
              DLL Characteristics:
              Time Stamp:0x55666469 [Thu May 28 00:42:17 2015 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:4
              OS Version Minor:0
              File Version Major:4
              File Version Minor:0
              Subsystem Version Major:4
              Subsystem Version Minor:0
              Import Hash:2c08d8f9644132654eb702b279083d5c

              Entrypoint Preview

              Instruction
              push 00401CE4h
              call 00007FAA30BA3E75h
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              xor byte ptr [eax], al
              add byte ptr [eax], al
              dec eax
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [edi-27h], dh
              jmp 00007FA9B949D89Fh
              dec ebx
              mov eax, dword ptr [C987BF43h]
              jmp 00007FAA30BA3F11h
              add byte ptr [eax], al
              add byte ptr [ecx], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], ch
              js 00007FAA30BA3ECCh
              add ah, byte ptr [esi+6Fh]
              outsb
              jnc 00007FAA30BA3EE7h
              imul esi, dword ptr [ebx+70h], 7469736Fh
              imul ebp, dword ptr [edi+6Eh], 00007265h
              pop esp
              js 00007FAA30BA3ECCh
              add al, byte ptr [eax]
              add byte ptr [eax], al
              add bh, bh
              int3
              xor dword ptr [eax], eax
              sysexit
              call 00007FAA8F2F5C7Eh
              add dword ptr [esi-7Ch], 4Eh
              pop ds
              iretd
              pop es
              push ds
              mov ecx, D6CDFD7Ch
              push cs
              mov bl, E3h
              jmp 00007FA9E4BAF5C8h
              add eax, dword ptr [edi+3A4CBACAh]
              dec edi
              lodsd
              xor ebx, dword ptr [ecx-48EE309Ah]
              or al, 00h
              stosb
              add byte ptr [eax-2Dh], ah
              xchg eax, ebx
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              add byte ptr [eax], al
              scasb
              add al, byte ptr [eax]
              add byte ptr [eax+eax+00h], bl
              add byte ptr [eax], al
              or al, 00h
              dec ebx
              jbe 00007FAA30BA3EEBh
              jnc 00007FAA30BA3EF6h
              jbe 00007FAA30BA3EEBh
              outsb
              jne 00007FAA30BA3EE8h

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IMPORT0x213340x28.text
              IMAGE_DIRECTORY_ENTRY_RESOURCE0x240000x938.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
              IMAGE_DIRECTORY_ENTRY_IAT0x10000x1dc.text
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

              Sections

              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x10000x20a0c0x21000False0.382043087121data6.05770286858IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              .data0x220000x12780x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
              .rsrc0x240000x9380x1000False0.16943359375data1.99495940529IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

              Resources

              NameRVASizeTypeLanguageCountry
              RT_ICON0x248080x130data
              RT_ICON0x245200x2e8data
              RT_ICON0x243f80x128GLS_BINARY_LSB_FIRST
              RT_GROUP_ICON0x243c80x30data
              RT_VERSION0x241500x278dataEnglishUnited States

              Imports

              DLLImport
              MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaHresultCheck, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaBoolStr, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, __vbaVarTstLt, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaVarTstEq, __vbaR4Str, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaInStrVar, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaLateMemCall, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, __vbaVarCopy, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

              Version Infos

              DescriptionData
              Translation0x0409 0x04b0
              InternalNameForhaeng
              FileVersion1.00
              CompanyNameWorkday
              CommentsWorkday
              ProductNameWorkday
              ProductVersion1.00
              FileDescriptionWorkday
              OriginalFilenameForhaeng.exe

              Possible Origin

              Language of compilation systemCountry where language is spokenMap
              EnglishUnited States

              Network Behavior

              No network behavior found

              Code Manipulations

              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              System Behavior

              General

              Start time:16:19:32
              Start date:15/06/2021
              Path:C:\Users\user\Desktop\uWDCUIgE95.exe
              Wow64 process (32bit):true
              Commandline:'C:\Users\user\Desktop\uWDCUIgE95.exe'
              Imagebase:0x400000
              File size:147456 bytes
              MD5 hash:E6C676EA92D72DA7F2D79F8AFC468CF5
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:Visual Basic
              Yara matches:
              • Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
              • Rule: JoeSecurity_GuLoader_1, Description: Yara detected GuLoader, Source: 00000001.00000000.229326880.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
              • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.592412428.00000000021F0000.00000040.00000001.sdmp, Author: Joe Security
              Reputation:low

              Disassembly

              Code Analysis

              Reset < >

                Executed Functions

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041A844
                • #679.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,?,?), ref: 0041A87A
                • __vbaFpR8.MSVBVM60 ref: 0041A880
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041A8B3
                • __vbaVarDup.MSVBVM60 ref: 0041A910
                • #596.MSVBVM60(?,?,?,?,?,?,?), ref: 0041A935
                • __vbaStrMove.MSVBVM60 ref: 0041A940
                • __vbaFreeVarList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0041A967
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041A97F
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041A998
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403A44,000001E8), ref: 0041A9C5
                • __vbaFreeObj.MSVBVM60 ref: 0041A9CE
                • __vbaVarDup.MSVBVM60 ref: 0041A9F1
                • #553.MSVBVM60(?,?), ref: 0041A9FF
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041AA24
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041AA3A
                • __vbaVarDup.MSVBVM60 ref: 0041AA94
                • #596.MSVBVM60(?,?,?,?,?,?,?), ref: 0041AAB9
                • __vbaStrMove.MSVBVM60 ref: 0041AAC4
                • __vbaFreeVarList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0041AAEB
                • __vbaFreeStr.MSVBVM60(0041AB42), ref: 0041AB35
                • __vbaFreeStr.MSVBVM60 ref: 0041AB3A
                • __vbaFreeStr.MSVBVM60 ref: 0041AB3F
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$List$#596Move$#553#679CheckCopyHresultNew2
                • String ID: 01/01/01$Maumeenondesignateunlimited$Skrivelrer1
                • API String ID: 207475868-2032125864
                • Opcode ID: 06733e9a4f1f804de63b9609b0c585e3fdcf2597fe9178951eb4e4c93a3213c5
                • Instruction ID: 32b0cee954691121be10c4371d034676a4f95aa5796285b766766dcdf1c6ebba
                • Opcode Fuzzy Hash: 06733e9a4f1f804de63b9609b0c585e3fdcf2597fe9178951eb4e4c93a3213c5
                • Instruction Fuzzy Hash: 01A1C3B1C1022DAFCB14CF94DD84AEEBBB8FB58704F14415EE509A7250DBB41A89CF94
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: #100
                • String ID: VB5!6&*
                • API String ID: 1341478452-3593831657
                • Opcode ID: f613a14c589f8d1c7a903b073ce1ca82a12487ba7d94097b06c40443b03063c4
                • Instruction ID: c0666289bed12fce74813a4ce571c348c5c2972b1b9af97e93222dccdc57c582
                • Opcode Fuzzy Hash: f613a14c589f8d1c7a903b073ce1ca82a12487ba7d94097b06c40443b03063c4
                • Instruction Fuzzy Hash: ABD0B60219E3C20EE30763B68C254996F705C0726130F02EB90A0EE0F3D9AC4948C33B
                Uniqueness

                Uniqueness Score: -1.00%

                Non-executed Functions

                C-Code - Quality: 82%
                			E00405715() {
                				intOrPtr* _t6;
                				intOrPtr* _t15;
                				void* _t29;
                				void* _t39;
                				void* _t40;
                
                				 *_t6 =  *_t6 + 1;
                				_t15 =  *((intOrPtr*)(0x40100c));
                				do {
                					_t15 = _t15 + 0xffffffff;
                					asm("pushfd");
                					asm("popfd");
                				} while ( *_t15 != 0xd97e9646);
                				_t29 =  *((intOrPtr*)( *((intOrPtr*)(_t15 + 0x10cc))))(0, 0x11000, 0x370e3acb, 0x40);
                				_t39 = 0xc43c;
                				do {
                					 *(_t29 + _t39) = 0 ^  *(0x4059ca + _t39);
                					 *(_t29 + _t39) =  *(_t29 + _t39) ^ 0xc7244a26;
                					_t40 = _t39 - 0x242;
                					_t39 = _t40 + 0x23e;
                				} while (_t39 >= 0);
                				goto __eax;
                			}








                0x00405717
                0x00405776
                0x004057dd
                0x004057e6
                0x004057ef
                0x004057f0
                0x004057f0
                0x00405943
                0x00405953
                0x00405963
                0x00405980
                0x0040598c
                0x0040599a
                0x004059b5
                0x004059b5
                0x004059bf

                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID:
                • String ID: "$/
                • API String ID: 0-2662438755
                • Opcode ID: 981d679cdc337aff401b678fde87f3a95384fc13ba84550ba8be55c9ceeded21
                • Instruction ID: 2960aa084d5bb6229f4dbf0facbe20f7294577cd3a730e4fb50fcb3fabf1fc07
                • Opcode Fuzzy Hash: 981d679cdc337aff401b678fde87f3a95384fc13ba84550ba8be55c9ceeded21
                • Instruction Fuzzy Hash: 3151B8926663428AFF780574C6E0B3E2156DB4A300F749E3BC503EBEDADA2EC0C54613
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • #517.MSVBVM60(00403A08), ref: 00420BBA
                • __vbaStrMove.MSVBVM60 ref: 00420BC5
                • __vbaStrCmp.MSVBVM60(00403994,00000000), ref: 00420BD1
                • __vbaFreeStr.MSVBVM60 ref: 00420BE4
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 00420C01
                • __vbaLateMemCallLd.MSVBVM60(?,?,uQzYfoIri7ddvc3x8FN7bmsdWeJ3OQrppbhD233,00000000), ref: 00420C1D
                • __vbaObjVar.MSVBVM60(00000000), ref: 00420C27
                • __vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00420C32
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000000C), ref: 00420C4C
                • __vbaFreeObj.MSVBVM60 ref: 00420C55
                • __vbaFreeVar.MSVBVM60 ref: 00420C5E
                • __vbaVarDup.MSVBVM60 ref: 00420C80
                • #562.MSVBVM60(?), ref: 00420C8A
                • __vbaFreeVar.MSVBVM60 ref: 00420CA1
                • _adj_fdiv_m64.MSVBVM60 ref: 00420CD3
                • __vbaFpI4.MSVBVM60(42820000,?,434A0000), ref: 00420D04
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033B0,000002C0,?,434A0000), ref: 00420D38
                • #610.MSVBVM60(?), ref: 00420D48
                • #610.MSVBVM60(?), ref: 00420D4E
                • __vbaVarAdd.MSVBVM60(?,00000009,?,00000001,00000001), ref: 00420D76
                • #662.MSVBVM60(?,004038C4,?,00000000), ref: 00420D8A
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 00420DAB
                • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 00420DC6
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 00420DE6
                • __vbaObjVar.MSVBVM60(?), ref: 00420DF8
                • __vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00420E03
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000010), ref: 00420E1D
                • __vbaFreeObj.MSVBVM60 ref: 00420E26
                • __vbaFreeObj.MSVBVM60(00420E79), ref: 00420E69
                • __vbaFreeVar.MSVBVM60 ref: 00420E72
                Strings
                • uQzYfoIri7ddvc3x8FN7bmsdWeJ3OQrppbhD233, xrefs: 00420C11
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$#610AddrefNew2$#517#562#662CallLateListMove_adj_fdiv_m64
                • String ID: uQzYfoIri7ddvc3x8FN7bmsdWeJ3OQrppbhD233
                • API String ID: 3516706468-3714022841
                • Opcode ID: afbb93b7381bbe84c1de5a96b6a8e6d1e7a75448b0ac4819a21611f7e2fbfc7a
                • Instruction ID: 948483ebd63d12741cb7bae7d4ef61d40384292b727c6f8eb5ec0c6acae41c69
                • Opcode Fuzzy Hash: afbb93b7381bbe84c1de5a96b6a8e6d1e7a75448b0ac4819a21611f7e2fbfc7a
                • Instruction Fuzzy Hash: 57816EB1D00219EFDB149FA5EE48AEDBBB8FB08701F50816AF546B21A0CB745945CF68
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041B6CC
                • #670.MSVBVM60(?), ref: 0041B6D6
                • __vbaVarTstEq.MSVBVM60(?,?), ref: 0041B6F2
                • __vbaFreeVar.MSVBVM60 ref: 0041B6FE
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041B720
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041B739
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A18,000001B8), ref: 0041B760
                • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,00000000), ref: 0041B771
                • __vbaStrVarMove.MSVBVM60(00000000), ref: 0041B77B
                • __vbaStrMove.MSVBVM60 ref: 0041B786
                • #716.MSVBVM60(?,00000000), ref: 0041B791
                • __vbaLateIdSt.MSVBVM60(?,00000000), ref: 0041B7B8
                • __vbaFreeStr.MSVBVM60 ref: 0041B7C1
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041B7D1
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041B7E1
                • __vbaI4Str.MSVBVM60(00403988), ref: 0041B7EF
                • #697.MSVBVM60(00000000), ref: 0041B7F6
                • __vbaStrMove.MSVBVM60 ref: 0041B801
                • __vbaStrCmp.MSVBVM60(00403994,00000000), ref: 0041B80D
                • __vbaFreeStr.MSVBVM60 ref: 0041B820
                • #570.MSVBVM60(000000B9), ref: 0041B830
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041B849
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041B862
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403D34,00000068), ref: 0041B883
                • __vbaFreeObj.MSVBVM60 ref: 0041B892
                • __vbaFreeStr.MSVBVM60(0041B8E0), ref: 0041B8D0
                • __vbaFreeObj.MSVBVM60 ref: 0041B8D9
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$Move$CheckHresultLateListNew2$#570#670#697#716CallCopy
                • String ID: Spheniscomorphae1
                • API String ID: 1019445086-1645407306
                • Opcode ID: 8c474a77dfec678245f37db4cfb46ed9b19d9aa6f76cad8407eb03d0c6014668
                • Instruction ID: 28d61a9ff0de72b6cb42ee55d1c8c2760cc795c92427d053e4a7d02e09a00bd5
                • Opcode Fuzzy Hash: 8c474a77dfec678245f37db4cfb46ed9b19d9aa6f76cad8407eb03d0c6014668
                • Instruction Fuzzy Hash: FD611B74900209AFCB14DFA4DE49DEEBBB9FF58701B10852AF502B72A0DB745945CFA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041ABDA
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041ABF3
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A44,0000020C), ref: 0041AC16
                • __vbaFreeObj.MSVBVM60 ref: 0041AC1F
                • __vbaVarDup.MSVBVM60 ref: 0041AC48
                • #553.MSVBVM60(?,?), ref: 0041AC52
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041AC77
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041AC90
                • __vbaVarDup.MSVBVM60 ref: 0041ACF2
                • #596.MSVBVM60(?,?,?,?,?,?,?), ref: 0041AD16
                • __vbaStrMove.MSVBVM60 ref: 0041AD21
                • __vbaFreeVarList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0041AD4B
                • __vbaLenBstr.MSVBVM60(00403EE8), ref: 0041AD55
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041AD77
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000001C), ref: 0041AD9C
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403E48,00000054,?,?,?,?), ref: 0041ADF2
                • __vbaLateIdSt.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?), ref: 0041AE29
                • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?), ref: 0041AE32
                • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?), ref: 0041AE3B
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041AE54
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041AE6D
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,00000060), ref: 0041AE91
                • __vbaFreeObj.MSVBVM60 ref: 0041AEA3
                • __vbaFreeObj.MSVBVM60(0041AF01), ref: 0041AEF1
                • __vbaFreeStr.MSVBVM60 ref: 0041AEFA
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$New2$List$#553#596BstrLateMove
                • String ID: 01/01/01$Catecholamines
                • API String ID: 2020296758-1285120401
                • Opcode ID: b2f7a7bec3444c2b69447083a08dedad1469acd591f8917e8f43872f48bbf76a
                • Instruction ID: 13ea664cc3cfaace748a23f309e8fcaaeafca4fb68ffad1a8e1c159560a28b6d
                • Opcode Fuzzy Hash: b2f7a7bec3444c2b69447083a08dedad1469acd591f8917e8f43872f48bbf76a
                • Instruction Fuzzy Hash: 46B158B5A01319AFCB14CFA5DA48BDEBBB8FF48700F10816AE509B72A0D7745A45CF64
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 004206EB
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042070A
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001FC), ref: 00420749
                • __vbaFreeObj.MSVBVM60 ref: 00420758
                • #674.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,?,?), ref: 00420794
                • __vbaFpR8.MSVBVM60 ref: 0042079A
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004207C0
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 004207E7
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000004C), ref: 0042080C
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403F8C,0000001C,?,?,?,?), ref: 00420850
                • __vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 0042086B
                • __vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00420876
                • #519.MSVBVM60( rr), ref: 0042087D
                • __vbaStrMove.MSVBVM60 ref: 00420888
                • __vbaStrCmp.MSVBVM60(0040403C,00000000), ref: 00420894
                • __vbaFreeStr.MSVBVM60 ref: 004208A7
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 004208C9
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 004208E2
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001C0), ref: 00420905
                • __vbaLateMemCall.MSVBVM60(?,O6LxHL51aTnkYsQDbH68,00000002), ref: 00420961
                • __vbaFreeObj.MSVBVM60 ref: 0042096D
                • __vbaFreeVar.MSVBVM60 ref: 00420972
                • __vbaFreeObj.MSVBVM60(004209CC), ref: 004209C4
                • __vbaFreeObj.MSVBVM60 ref: 004209C9
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$New2$#519#674CallLateListMove
                • String ID: rr$O6LxHL51aTnkYsQDbH68
                • API String ID: 13828861-3451368691
                • Opcode ID: 442a0c8927888ce7afa7ec583b52e27b5b23e0baec0e06c063cdf4fe1b925087
                • Instruction ID: f0822d4c61637155f86261dca48dfa7d6c620e68cca898666eba4d57dd624fc2
                • Opcode Fuzzy Hash: 442a0c8927888ce7afa7ec583b52e27b5b23e0baec0e06c063cdf4fe1b925087
                • Instruction Fuzzy Hash: 61A12EB1A00214ABDB14DFA8DD85B9EBBF8FF48700F10816AE905B73A5D7749805CF98
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaAryConstruct2.MSVBVM60(?,00403A2C,00000008), ref: 0041B95D
                • __vbaVarDup.MSVBVM60 ref: 0041B977
                • #544.MSVBVM60(?,?), ref: 0041B985
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041B9AA
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041B9BD
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033B0,000002B0), ref: 0041BA3A
                • __vbaStrCopy.MSVBVM60 ref: 0041BA4E
                • __vbaStrCopy.MSVBVM60 ref: 0041BA5B
                • __vbaVarDup.MSVBVM60 ref: 0041BA76
                • #710.MSVBVM60(00000008,?), ref: 0041BA9D
                • __vbaStrMove.MSVBVM60 ref: 0041BAA8
                • __vbaStrCmp.MSVBVM60(00403A10,00000000), ref: 0041BAB4
                • __vbaFreeStr.MSVBVM60 ref: 0041BAC7
                • __vbaFreeVar.MSVBVM60 ref: 0041BAD0
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041BAF1
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000001C), ref: 0041BB16
                • __vbaCastObj.MSVBVM60(?,00403964), ref: 0041BB4B
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041BB56
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403E48,00000058), ref: 0041BB70
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041BB80
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$CopyList$#544#710CastConstruct2MoveNew2
                • String ID: 20:20:20
                • API String ID: 1246080522-1725373740
                • Opcode ID: fd0a33645654cf52c2e1cf8aa3f64ceb82ac601e2a7c9df9fe3e2e39bfee3997
                • Instruction ID: 0970a1b76e3bd9de65f31928d64dd3bc76789c59151388a9f605b35c5ee0d84b
                • Opcode Fuzzy Hash: fd0a33645654cf52c2e1cf8aa3f64ceb82ac601e2a7c9df9fe3e2e39bfee3997
                • Instruction Fuzzy Hash: 968167B0D00209EFCB10DFA9C989ADEBBB8FF48700F10816AE509B72A1D7745945CFA4
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041FBF9
                • __vbaStrCopy.MSVBVM60 ref: 0041FC01
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041FC15
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000014), ref: 0041FC40
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004038F8,000000F0), ref: 0041FC6E
                • __vbaStrMove.MSVBVM60 ref: 0041FC79
                • __vbaFreeObj.MSVBVM60 ref: 0041FC82
                • #693.MSVBVM60(00403994), ref: 0041FC8D
                • #532.MSVBVM60(DEDD), ref: 0041FC9C
                • #660.MSVBVM60(?,?,?,00000001,00000001), ref: 0041FCCF
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041FCF0
                • __vbaFreeVarList.MSVBVM60(00000003,00000002,0000000A,?), ref: 0041FD07
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041FD2B
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000004C), ref: 0041FD50
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403F8C,0000001C,?,?,?,?), ref: 0041FD9D
                • __vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 0041FDAE
                • __vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0041FDB7
                • __vbaFreeStr.MSVBVM60(0041FE27), ref: 0041FE11
                • __vbaFreeObj.MSVBVM60 ref: 0041FE16
                • __vbaFreeStr.MSVBVM60 ref: 0041FE1F
                • __vbaFreeStr.MSVBVM60 ref: 0041FE24
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$CopyNew2$#532#660#693ListMove
                • String ID: DEDD
                • API String ID: 303901731-2798080213
                • Opcode ID: 42d67dd04036d18ca8179c2d6af20af6b7a8b754bcafaf210fc38ca80659e52a
                • Instruction ID: 3e3a5a60572b20d6211624793f0ce0946c7c109f5de3c84bb40999dd55292c90
                • Opcode Fuzzy Hash: 42d67dd04036d18ca8179c2d6af20af6b7a8b754bcafaf210fc38ca80659e52a
                • Instruction Fuzzy Hash: C4711AB1900219AFCB10DF94D985ADEBBB9FF48B00F20816AF505B72A1D7745986CF98
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • #616.MSVBVM60(00403A10,00000001), ref: 0041C257
                • __vbaStrMove.MSVBVM60 ref: 0041C268
                • __vbaStrCmp.MSVBVM60(00403A08,00000000), ref: 0041C270
                • __vbaFreeStr.MSVBVM60 ref: 0041C283
                • #571.MSVBVM60(0000002B), ref: 0041C290
                • __vbaI4Str.MSVBVM60(00403988), ref: 0041C29B
                • #697.MSVBVM60(00000000), ref: 0041C2A2
                • __vbaStrMove.MSVBVM60 ref: 0041C2AD
                • __vbaStrCmp.MSVBVM60(00403994,00000000), ref: 0041C2B5
                • __vbaFreeStr.MSVBVM60 ref: 0041C2C8
                • #570.MSVBVM60(000000AD), ref: 0041C2D8
                • __vbaStrCopy.MSVBVM60 ref: 0041C2E6
                • #524.MSVBVM60(?,?), ref: 0041C301
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041C31D
                • __vbaFreeVar.MSVBVM60 ref: 0041C329
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041C34A
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000001C), ref: 0041C36F
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403E48,00000060), ref: 0041C3BE
                • __vbaFreeObj.MSVBVM60 ref: 0041C3C7
                • __vbaFreeStr.MSVBVM60(0041C404), ref: 0041C3FD
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresultMove$#524#570#571#616#697CopyNew2
                • String ID: Parisiskes8
                • API String ID: 4051536704-4275025436
                • Opcode ID: 7b99db9299eaa1dbed790a9d14afdea2d2eae9f3349ba7fdc8502cf815f86764
                • Instruction ID: 33e22ac1843596cc75267862b14c16ceada062fb857319f1c690793e973d0b42
                • Opcode Fuzzy Hash: 7b99db9299eaa1dbed790a9d14afdea2d2eae9f3349ba7fdc8502cf815f86764
                • Instruction Fuzzy Hash: 41515F71940258EFCB14DFA4DE49ADEBBB8FB48701F208126E506B72A0D7785D45CF58
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaAryConstruct2.MSVBVM60(?,00403A2C,00000008), ref: 00414391
                • __vbaStrCopy.MSVBVM60 ref: 004143A5
                • __vbaStrCopy.MSVBVM60 ref: 004143B2
                • __vbaVarDup.MSVBVM60 ref: 004143C4
                • #710.MSVBVM60(?,?), ref: 004143E5
                • __vbaStrMove.MSVBVM60 ref: 004143F0
                • __vbaStrCmp.MSVBVM60(00403A10,00000000), ref: 004143FC
                • __vbaFreeStr.MSVBVM60 ref: 0041440F
                • __vbaFreeVar.MSVBVM60 ref: 00414418
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041443A
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414459
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A18,00000170), ref: 0041447C
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00414495
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 004144AE
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403998,00000120), ref: 004144D1
                • __vbaFpI4.MSVBVM60 ref: 004144E2
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033B0,000002C8), ref: 0041452E
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041453E
                • __vbaAryDestruct.MSVBVM60(00000000,?,0041458F), ref: 00414588
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckFreeHresult$CopyNew2$#710Construct2DestructListMove
                • String ID: R(
                • API String ID: 799147137-4242638291
                • Opcode ID: 718797a7605e4e5588213be7cc12b2035df07a7766fd904136b2a0e7cd026106
                • Instruction ID: 956273d70337f336d29ce55bad71fffed09dea5552048a34bfd642675283c09c
                • Opcode Fuzzy Hash: 718797a7605e4e5588213be7cc12b2035df07a7766fd904136b2a0e7cd026106
                • Instruction Fuzzy Hash: 62514E70900218ABDB10DFA4DD89EDDBBB9FF88701F10852AF546B72A0DB745945CF68
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041B47E
                • __vbaStrCopy.MSVBVM60 ref: 0041B486
                • __vbaRedim.MSVBVM60(00000880,00000010,?,00000000,00000001,00000003,00000000), ref: 0041B499
                • __vbaVarMove.MSVBVM60 ref: 0041B4C9
                • __vbaVarCopy.MSVBVM60 ref: 0041B4F5
                • __vbaVarMove.MSVBVM60 ref: 0041B519
                • __vbaVarCopy.MSVBVM60 ref: 0041B541
                • #668.MSVBVM60(?,?), ref: 0041B54B
                • __vbaErase.MSVBVM60(00000000,?), ref: 0041B556
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041B57B
                • __vbaFreeVar.MSVBVM60 ref: 0041B587
                • __vbaEnd.MSVBVM60 ref: 0041B592
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041B5AB
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041B5C4
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001EC), ref: 0041B612
                • __vbaFreeObj.MSVBVM60 ref: 0041B61B
                • __vbaFreeStr.MSVBVM60(0041B662), ref: 0041B65A
                • __vbaFreeStr.MSVBVM60 ref: 0041B65F
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CopyFree$Move$#668CheckEraseHresultNew2Redim
                • String ID: plums
                • API String ID: 975322020-90554558
                • Opcode ID: 536c27a8b10e227e49677f374250039714b817da03b1edb1aebb51f48ba29fa7
                • Instruction ID: ddce9c2a5989a39470ff1addcbd007a3225c7d3c60c5bf7dff800f858b7dd129
                • Opcode Fuzzy Hash: 536c27a8b10e227e49677f374250039714b817da03b1edb1aebb51f48ba29fa7
                • Instruction Fuzzy Hash: 0C616070D00259DFDB14DFA8DD88A9DBBB9FF48700F10812AE505BB2A0D7746945CF94
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033B0,000000A8), ref: 0041F878
                • __vbaStrCmp.MSVBVM60(00000000,?), ref: 0041F883
                • __vbaFreeStr.MSVBVM60 ref: 0041F895
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041F8BD
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041F8E0
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A18,00000198), ref: 0041F903
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041F91C
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041F931
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A54,00000048), ref: 0041F94E
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041F967
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000004C), ref: 0041F988
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403F8C,00000024), ref: 0041F9B4
                • __vbaStrMove.MSVBVM60 ref: 0041F9C7
                • __vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041F9D7
                • __vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0041F9EB
                • __vbaOnError.MSVBVM60(00000000), ref: 0041FA04
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041FA1D
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FA32
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403998,000001A8), ref: 0041FA51
                • __vbaFreeObj.MSVBVM60 ref: 0041FA5A
                • __vbaFreeStr.MSVBVM60(0041FA9D), ref: 0041FA96
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckHresult$Free$New2$List$ErrorMove
                • String ID:
                • API String ID: 2931715464-0
                • Opcode ID: d3cfd14e4bcdefbdf44b20ac672293864138487fd8a3d8903e022ee093718f16
                • Instruction ID: 7065ee0fe03767b450da8741cd4a5af80e2f2cc6508fe4406de8ec6b16dc863a
                • Opcode Fuzzy Hash: d3cfd14e4bcdefbdf44b20ac672293864138487fd8a3d8903e022ee093718f16
                • Instruction Fuzzy Hash: 13716F71A00214ABDB14EFA5DD48EDABBBCFF58700F10442AF945F72A0D7B89945CB68
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041BC61
                • __vbaVarDup.MSVBVM60 ref: 0041BC7B
                • #564.MSVBVM60(?,?), ref: 0041BC89
                • __vbaHresultCheck.MSVBVM60(00000000), ref: 0041BC94
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041BCB0
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041BCC3
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041BCE3
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000048), ref: 0041BD0A
                • __vbaStrMove.MSVBVM60 ref: 0041BD19
                • #554.MSVBVM60 ref: 0041BD1F
                • __vbaR4Str.MSVBVM60(004039D4), ref: 0041BD2A
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041BD54
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041BD6D
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,00000130), ref: 0041BD94
                • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041BDA6
                • __vbaI4Var.MSVBVM60(00000000), ref: 0041BDB0
                • __vbaHresultCheckObj.MSVBVM60(00000000,00401460,004033B0,00000084), ref: 0041BE07
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041BE17
                • __vbaFreeVar.MSVBVM60 ref: 0041BE23
                • __vbaFreeStr.MSVBVM60(0041BE7A), ref: 0041BE72
                • __vbaFreeStr.MSVBVM60 ref: 0041BE77
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$ListNew2$#554#564CallCopyLateMove
                • String ID:
                • API String ID: 668867254-0
                • Opcode ID: bb057ee8692c06c593ec267bc320f317b721f35398c3cc098b7ab84aa669d4cf
                • Instruction ID: 417371df3e0e9a5d1395ff075381e1780005c1465f052206ee95af2b657fd5f4
                • Opcode Fuzzy Hash: bb057ee8692c06c593ec267bc320f317b721f35398c3cc098b7ab84aa669d4cf
                • Instruction Fuzzy Hash: B2613A70D00209EFCB149FA5D949AEEBBB8FF58701F10815AE545B72A0DB741945CFA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 00420FD4
                • __vbaStrCopy.MSVBVM60 ref: 00420FDC
                • __vbaStrCopy.MSVBVM60 ref: 00420FE4
                • __vbaStrCopy.MSVBVM60 ref: 00420FEC
                • #676.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,?,?), ref: 0042101E
                • __vbaFpR8.MSVBVM60 ref: 00421024
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00421050
                • __vbaEnd.MSVBVM60 ref: 0042105C
                • __vbaVarDup.MSVBVM60 ref: 00421076
                • #564.MSVBVM60(?,?), ref: 00421084
                • __vbaHresultCheck.MSVBVM60(00000000), ref: 0042108F
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 004210AB
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004210BE
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 004210DA
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000048), ref: 00421104
                • __vbaStrMove.MSVBVM60 ref: 00421113
                • __vbaFreeStr.MSVBVM60(00421162), ref: 0042114B
                • __vbaFreeStr.MSVBVM60 ref: 00421150
                • __vbaFreeStr.MSVBVM60 ref: 00421155
                • __vbaFreeStr.MSVBVM60 ref: 0042115A
                • __vbaFreeStr.MSVBVM60 ref: 0042115F
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$Copy$CheckHresultList$#564#676MoveNew2
                • String ID:
                • API String ID: 2576684927-0
                • Opcode ID: 91702de7b0e1c57f74bfc30bd78a73f15b0b9425f63e38e609b698bb8b0ecf3e
                • Instruction ID: 20f8f83c4fd5ed0964ff46f1e34c273931d758c57a2bac3b8a2fa6d5a8a106d1
                • Opcode Fuzzy Hash: 91702de7b0e1c57f74bfc30bd78a73f15b0b9425f63e38e609b698bb8b0ecf3e
                • Instruction Fuzzy Hash: 3E514870D00219AFCB14DFA4DD85AEEBBB8FF58B00F10811AE511B7260DB746906CFA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041460F
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041462E
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A44,000000D0), ref: 00414651
                • #592.MSVBVM60(?), ref: 0041466A
                • __vbaFreeObj.MSVBVM60 ref: 0041467F
                • __vbaFreeVar.MSVBVM60 ref: 0041468E
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 004146AC
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 004146C5
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403998,00000050), ref: 004146E2
                • #716.MSVBVM60(00000002,?,00000000), ref: 004146F2
                • __vbaLateIdSt.MSVBVM60(?,00000000), ref: 0041471A
                • __vbaFreeStr.MSVBVM60 ref: 00414723
                • __vbaFreeObj.MSVBVM60 ref: 0041472C
                • __vbaFreeVar.MSVBVM60 ref: 00414735
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041474A
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414763
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A54,00000068), ref: 00414780
                • __vbaFreeObj.MSVBVM60 ref: 0041478F
                • __vbaFreeObj.MSVBVM60(004147C3), ref: 004147BC
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresultNew2$#592#716Late
                • String ID:
                • API String ID: 3616571326-0
                • Opcode ID: 4aec1292c5b2c8e2e5fc2646fb65ba4977fd9a13397f7c4e766e956d0cab6f27
                • Instruction ID: 4ff592d193183359f51b698d5ede7e475b923705fd29eff95240a52782c4dece
                • Opcode Fuzzy Hash: 4aec1292c5b2c8e2e5fc2646fb65ba4977fd9a13397f7c4e766e956d0cab6f27
                • Instruction Fuzzy Hash: FF513974A00205ABCB14DFA5DE88EDEBBB8FF49701F10812AE505F72A0D7749945CFA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041C7DA
                • __vbaBoolStr.MSVBVM60(True), ref: 0041C7E5
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041C808
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041C821
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403B60,00000178), ref: 0041C848
                • _adj_fdiv_m64.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041C871
                • __vbaFpI4.MSVBVM60(436A0000,?,42900000), ref: 0041C89F
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033B0,000002C0,?,42900000), ref: 0041C8D8
                • __vbaFreeObj.MSVBVM60(?,42900000), ref: 0041C8E1
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041C8FA
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041C913
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001EC), ref: 0041C95B
                • __vbaFreeObj.MSVBVM60 ref: 0041C964
                • __vbaFreeStr.MSVBVM60(0041C986), ref: 0041C97F
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckFreeHresult$New2$BoolCopy_adj_fdiv_m64
                • String ID: Pleurococcaceae$True
                • API String ID: 3244786466-1036221138
                • Opcode ID: 62a3835b9bfc73fd91dbc25a9080925bf6e6c85b514c67bc795d1bba143c891e
                • Instruction ID: fe848bea2bf8fc2d1af3b11bd764e7429b6c48bebc8e7c26f5a712e372dbe1ef
                • Opcode Fuzzy Hash: 62a3835b9bfc73fd91dbc25a9080925bf6e6c85b514c67bc795d1bba143c891e
                • Instruction Fuzzy Hash: EB517F74A40205EBCB109FA4DE89FAE7BB9FB49705F104425F546B72F0C7749941CBA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A3D
                • #706.MSVBVM60(00000001,00000000,00000000), ref: 00420A47
                • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A58
                • __vbaI4Str.MSVBVM60(00403988,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A5F
                • #537.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A66
                • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A71
                • __vbaStrCmp.MSVBVM60(00403994,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A79
                • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A8C
                • __vbaEnd.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420A97
                • __vbaNew2.MSVBVM60(00402540,00422010,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420AB0
                • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420AC9
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001EC), ref: 00420B11
                • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420B1A
                • __vbaFreeStr.MSVBVM60(00420B4B,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420B43
                • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420B48
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$Move$#537#706CheckCopyHresultNew2
                • String ID: tippernes
                • API String ID: 999016634-1619208553
                • Opcode ID: ccb01b1312350a948c38f2a35fb221516df17a3f55e545927aa768122b819ed1
                • Instruction ID: e5b6e4d35c7e85466b0a75e79e04c801d5f5fea8d0fa2c67eb7955a4778c2398
                • Opcode Fuzzy Hash: ccb01b1312350a948c38f2a35fb221516df17a3f55e545927aa768122b819ed1
                • Instruction Fuzzy Hash: 07315275A00214ABCB14DFA4DD49EAEBFB8FB58701F504126F906B72A0D7745901CFA9
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 00420285
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0042029D
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000014), ref: 004202C8
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004038F8,000000C0), ref: 004202F6
                • __vbaFreeObj.MSVBVM60 ref: 00420301
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00420316
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042032F
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403974,00000180), ref: 00420352
                • __vbaFreeObj.MSVBVM60 ref: 00420357
                • __vbaI4Str.MSVBVM60(00403988), ref: 0042035E
                • #608.MSVBVM60(?,00000000), ref: 00420369
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 00420385
                • __vbaFreeVar.MSVBVM60 ref: 00420391
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 004203AF
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000048), ref: 004203D6
                • __vbaStrMove.MSVBVM60 ref: 004203E5
                • __vbaFreeStr.MSVBVM60(00420429), ref: 00420421
                • __vbaFreeStr.MSVBVM60 ref: 00420426
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$New2$#608CopyMove
                • String ID:
                • API String ID: 4240346833-0
                • Opcode ID: 7f745355bbb71bd4db18c666b24f907fd5ce2b33b2b93006b2756fe97c1a5034
                • Instruction ID: cfe959a27675b67320a33401601b133ab62da086cff5e7895e9b15f44cffd38a
                • Opcode Fuzzy Hash: 7f745355bbb71bd4db18c666b24f907fd5ce2b33b2b93006b2756fe97c1a5034
                • Instruction Fuzzy Hash: 74514C71A00219AFCB10DFA5DD89E9EBBF8FF58705F10402AF905B72A0D7B85905CB68
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaI4Str.MSVBVM60(00403988), ref: 00413FC1
                • #608.MSVBVM60(?,00000000), ref: 00413FCC
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 00413FE8
                • __vbaFreeVar.MSVBVM60 ref: 00413FF4
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00414016
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414035
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403998,00000120), ref: 00414058
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00414071
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041408A
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004039A8,00000148), ref: 004140AD
                • __vbaInStrVar.MSVBVM60(?,00000000,00008008,?,?), ref: 004140E4
                • __vbaI4Var.MSVBVM60(00000000), ref: 004140EB
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004140FB
                • __vbaFreeVarList.MSVBVM60(00000002,00000009,?), ref: 0041410B
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresultListNew2$#608
                • String ID: passulate
                • API String ID: 821347214-629239217
                • Opcode ID: 54e331da4677e04e742420745d2e6954edcc09d34e49d163f23cd6f073b1c108
                • Instruction ID: ad4a56f6943677299134f54458e092088fc5f84d649f08157509180b95adb0a4
                • Opcode Fuzzy Hash: 54e331da4677e04e742420745d2e6954edcc09d34e49d163f23cd6f073b1c108
                • Instruction Fuzzy Hash: B45140B4900208AFCB10DF95DA88EEEBBB9FB48701F60442AF545F72A0D7745A45CB64
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041C46D
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041C486
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A44,000001E0), ref: 0041C4AD
                • #592.MSVBVM60(?), ref: 0041C4C6
                • __vbaFreeObj.MSVBVM60 ref: 0041C4DB
                • __vbaFreeVar.MSVBVM60 ref: 0041C4E4
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041C505
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000001C), ref: 0041C52A
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403E48,00000054), ref: 0041C570
                • __vbaLateIdSt.MSVBVM60(?,00000000), ref: 0041C5A2
                • __vbaFreeObj.MSVBVM60 ref: 0041C5AB
                • __vbaFreeVar.MSVBVM60 ref: 0041C5B4
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041C5CD
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041C5E6
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004039A8,000001CC), ref: 0041C66D
                • __vbaFreeObj.MSVBVM60 ref: 0041C676
                • __vbaFreeObj.MSVBVM60(0041C6B9), ref: 0041C6B2
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$New2$#592Late
                • String ID:
                • API String ID: 134990064-0
                • Opcode ID: f2f96c13180a3c7432bb4f9e491278a56434876a1349e6555e3629b2fe630f0d
                • Instruction ID: 63d8317faf7018abc51d2ecb5ef795ac9d085067d776fae93edec7d60ed51e0d
                • Opcode Fuzzy Hash: f2f96c13180a3c7432bb4f9e491278a56434876a1349e6555e3629b2fe630f0d
                • Instruction Fuzzy Hash: AB813C74A40214EFCB04DFA8D989A9DBBF9FF49701B20816AE509F73A0D7749941CF98
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041AF66
                • #594.MSVBVM60(?), ref: 0041AF7F
                • __vbaFreeVar.MSVBVM60 ref: 0041AF88
                • __vbaVarDup.MSVBVM60 ref: 0041AFA2
                • #544.MSVBVM60(?,?), ref: 0041AFB0
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041AFCC
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041AFDF
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004033B0,000002B0), ref: 0041B051
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041B06A
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041B083
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A44,000001E8), ref: 0041B0A6
                • __vbaFreeObj.MSVBVM60 ref: 0041B0AF
                • __vbaFreeStr.MSVBVM60(0041B0E7), ref: 0041B0E0
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$#544#594CopyListNew2
                • String ID: 20:20:20
                • API String ID: 225108240-1725373740
                • Opcode ID: ce16165b968a8908c0eeee2d42cef7d2d7d85e18e2adb0da64f90cebf8c82948
                • Instruction ID: 7dcf5987bb8241f89646ab63fa4638c54d8537d60e8911680aab0394950040b7
                • Opcode Fuzzy Hash: ce16165b968a8908c0eeee2d42cef7d2d7d85e18e2adb0da64f90cebf8c82948
                • Instruction Fuzzy Hash: 58510BB4900249DFDB04DFA8D989ADEBFF8FF48704F10812AE909BB2A4D7745945CB94
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00414843
                • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00414862
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001EC), ref: 004148A6
                • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 004148B5
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 004148CA
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 004148E3
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004039A8,000001C0), ref: 00414902
                • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041490B
                • #587.MSVBVM60(00000000,3FF00000), ref: 00414914
                • __vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041491A
                • #580.MSVBVM60(Styringscomputeren,00000001), ref: 00414934
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckFreeHresultNew2$#580#587
                • String ID: KANTSTENENS$Styringscomputeren
                • API String ID: 1664163399-2963900404
                • Opcode ID: 34b611efc3e4bb78ac619e479b81165eea555a3f1bcc199d63bd7879f38ae2dc
                • Instruction ID: cf731d0d74f218f9d76cd308e96ce331e53c3f835ca62eafaf2749a977466b29
                • Opcode Fuzzy Hash: 34b611efc3e4bb78ac619e479b81165eea555a3f1bcc199d63bd7879f38ae2dc
                • Instruction Fuzzy Hash: E4415574A40214AFCB109F64CE49F9A7BB8FF49701F104176F945F72A1C6789941CF98
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041FEBC
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FEDB
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403998,00000098), ref: 0041FEFE
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041FF17
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041FF30
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403D34,00000130), ref: 0041FFBD
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041FFCD
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041FFE9
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00420008
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00420024
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042003D
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000000A8), ref: 00420060
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A44,000001EC), ref: 004200A0
                • __vbaFreeStr.MSVBVM60 ref: 004200A9
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004200B9
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckHresultNew2$Free$List
                • String ID:
                • API String ID: 191279167-0
                • Opcode ID: 37f8004eadcc01ada02ae85c744bc93f5668d09a6f635cb18818c39dbcf706ac
                • Instruction ID: 4e02957a18494f297ff155a670374642fe16c1a0e11db08eaa04497fbd17190b
                • Opcode Fuzzy Hash: 37f8004eadcc01ada02ae85c744bc93f5668d09a6f635cb18818c39dbcf706ac
                • Instruction Fuzzy Hash: BC815174A00204AFDB10DFA8D989F9ABBF9FB49704F20806AE905F7391D7759906CF94
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041C00F
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0041C027
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000014), ref: 0041C04C
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004038F8,000000C0), ref: 0041C076
                • __vbaFreeObj.MSVBVM60 ref: 0041C07F
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041C098
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041C0B1
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403974,00000178), ref: 0041C138
                • __vbaFreeObj.MSVBVM60 ref: 0041C147
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041C15C
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041C175
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A18,000000F8), ref: 0041C19C
                • __vbaFreeObj.MSVBVM60 ref: 0041C1AB
                • __vbaFreeStr.MSVBVM60(0041C1DC), ref: 0041C1CC
                • __vbaFreeObj.MSVBVM60 ref: 0041C1D5
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$New2$Copy
                • String ID:
                • API String ID: 1628389849-0
                • Opcode ID: 6b24df55fc4498d6388701ee45dffb2808f6f11d20ffebb03195511f79098768
                • Instruction ID: bbe8e89d6217c9258e6ceac1fe5ba436791fe6f049789517e1ebd1a60893934a
                • Opcode Fuzzy Hash: 6b24df55fc4498d6388701ee45dffb2808f6f11d20ffebb03195511f79098768
                • Instruction Fuzzy Hash: 09616F74A40205EFCB14DF69DD89A9EBBB9FF49700F14806AF905B72A0D7749841CF98
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 004204B1
                • __vbaStrCopy.MSVBVM60 ref: 004204BB
                • #524.MSVBVM60(?,?), ref: 004204D2
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 004204EE
                • __vbaFreeVar.MSVBVM60 ref: 004204FA
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 0042051B
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,0000001C), ref: 00420540
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0042056A
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00420583
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000000A8), ref: 004205AA
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,00403E48,00000060), ref: 004205E5
                • __vbaFreeStr.MSVBVM60 ref: 004205EE
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004205FE
                • __vbaFreeStr.MSVBVM60(00420653), ref: 0042064B
                • __vbaFreeStr.MSVBVM60 ref: 00420650
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$CheckHresult$CopyNew2$#524List
                • String ID:
                • API String ID: 592294731-0
                • Opcode ID: 1f72892cba8100ef16f62465bf2c21557a1885866bdccd1af8b80229a2a50900
                • Instruction ID: d419e8a8fb62016648fd4f0714ab0da0b2ae2d17c2350960e87849a0def793d8
                • Opcode Fuzzy Hash: 1f72892cba8100ef16f62465bf2c21557a1885866bdccd1af8b80229a2a50900
                • Instruction Fuzzy Hash: 56513DB4E00219EFCB04DF95D989ADEBBB9FF98701F10801AE505B72A1C7B45945CF68
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • #610.MSVBVM60(?), ref: 00413959
                • #661.MSVBVM60(?,004038C4,00000000,3FF00000,?), ref: 0041396E
                • #610.MSVBVM60(?), ref: 00413978
                • __vbaVarAdd.MSVBVM60(?,?,?,?), ref: 00413998
                • __vbaVarTstNe.MSVBVM60(00000000), ref: 0041399F
                • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 004139BA
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 004139DA
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000048), ref: 00413A04
                • __vbaStrMove.MSVBVM60 ref: 00413A13
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 00413A2B
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000014), ref: 00413A50
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004038F8,000000B8), ref: 00413A7D
                • __vbaFreeObj.MSVBVM60 ref: 00413A86
                • __vbaFreeStr.MSVBVM60(00413AD0), ref: 00413AC9
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckFreeHresult$#610New2$#661ListMove
                • String ID:
                • API String ID: 4150538313-0
                • Opcode ID: 63862480f0ace7cad44684dd4dd37a08503bb72df481a2b2406caa8794715b6c
                • Instruction ID: 7d5bbd9e74f5e5e6608f2a623f978d70935ca765db4ccb65e2e51a7fbcd96601
                • Opcode Fuzzy Hash: 63862480f0ace7cad44684dd4dd37a08503bb72df481a2b2406caa8794715b6c
                • Instruction Fuzzy Hash: 79415C71D40219ABCB10DF94DD49EEEBBB8FF58701F10412AF505B71A0D7B82945CBA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 00413C60
                • #676.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,3FF00000,?,?), ref: 00413C96
                • __vbaFpR8.MSVBVM60 ref: 00413C9C
                • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00413CC7
                • __vbaNew2.MSVBVM60(004038E8,00422390), ref: 00413CE7
                • __vbaCastObj.MSVBVM60(?,00403964,ekspeditricerne), ref: 00413D03
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413D0E
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000040), ref: 00413D28
                • __vbaFreeObj.MSVBVM60 ref: 00413D31
                • __vbaFreeObj.MSVBVM60(00413D7D), ref: 00413D6D
                • __vbaFreeStr.MSVBVM60 ref: 00413D76
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$#676CastCheckCopyHresultListNew2
                • String ID: ekspeditricerne
                • API String ID: 2764453826-1880822252
                • Opcode ID: 1e36067dd1c4c63408d56bb494fa47dfdced79612360b416a20e719168918a19
                • Instruction ID: 1ae0fc0babc9d67f3a23976dacf6423cf9a6d43298f924b48df4bf60469a5cd3
                • Opcode Fuzzy Hash: 1e36067dd1c4c63408d56bb494fa47dfdced79612360b416a20e719168918a19
                • Instruction Fuzzy Hash: E73160B1900249AFCB14DF95DE49BEEBBB8FB48701F20412AF505B62A0D7781A41CF5C
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041B149
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041B162
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041B17B
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403974,0000016C), ref: 0041B19E
                • __vbaFreeObj.MSVBVM60 ref: 0041B1A7
                • #516.MSVBVM60(00403994), ref: 0041B1B2
                • __vbaVarDup.MSVBVM60 ref: 0041B1EE
                • #595.MSVBVM60(?,00000000,?,?,?), ref: 0041B205
                • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 0041B21D
                • __vbaFreeStr.MSVBVM60(0041B25C), ref: 0041B255
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$#516#595CheckCopyHresultListNew2
                • String ID: Festerment9
                • API String ID: 1659224419-664888475
                • Opcode ID: 16bd2eb86da492d64cdc6848ec6b8b2b6c0bf4a303c750e4b1613d0caee7d493
                • Instruction ID: 2c6744b780126a653ba05cf274aea3fde91b45e8f3cd472f07d6b10b2bad1273
                • Opcode Fuzzy Hash: 16bd2eb86da492d64cdc6848ec6b8b2b6c0bf4a303c750e4b1613d0caee7d493
                • Instruction Fuzzy Hash: 66412EB0900249AFCB14DF94D989EEEBFB8FF48705F10412AF505B72A0D7745585CB64
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00413DEA
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413E09
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00413E20
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413E39
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,00000218), ref: 00413E5C
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001EC), ref: 00413EA1
                • __vbaFreeStr.MSVBVM60 ref: 00413EAA
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413EBA
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00413ED6
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413EEF
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403974,00000088), ref: 00413F12
                • __vbaFreeObj.MSVBVM60 ref: 00413F21
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckFreeHresultNew2$List
                • String ID:
                • API String ID: 2509323985-0
                • Opcode ID: dc34b6d8d6e9ac3cae53c74435023bc8c472ace325448275e7ca0ac0227b1d1f
                • Instruction ID: 7f9149b23d94d81146c32df52fc8aa57490e0550b4bd45743767ecc1bf4cda9a
                • Opcode Fuzzy Hash: dc34b6d8d6e9ac3cae53c74435023bc8c472ace325448275e7ca0ac0227b1d1f
                • Instruction Fuzzy Hash: 53418474A00215AFCB10DFA4CD89FAE77B8FB08B01F104429F945F72A1D7749902CBA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00413B3F
                • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00413B47
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00413B5C
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00413B75
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001EC), ref: 00413BBD
                • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00413BC6
                • __vbaFreeStr.MSVBVM60(00413BF6), ref: 00413BEE
                • __vbaFreeStr.MSVBVM60 ref: 00413BF3
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$Copy$CheckHresultNew2
                • String ID: GENFREMSTILLINGEN$IO"K
                • API String ID: 1874231197-1947186289
                • Opcode ID: e5062d9291738d1dbd01ee9c510b0978df00a86cfb4b9e6b1e7cb19534defbfa
                • Instruction ID: 3574f176f876ceb93d2279cc17f1a04cd4808ff2dc1af1c01d5d1a03b5ab0a21
                • Opcode Fuzzy Hash: e5062d9291738d1dbd01ee9c510b0978df00a86cfb4b9e6b1e7cb19534defbfa
                • Instruction Fuzzy Hash: 01314F74A00219AFCB04DFA8D985ADEBBF9FF58700F10416AE905F72A1D774A941CF98
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 004141DD
                • __vbaR4Str.MSVBVM60(004039D4), ref: 004141E8
                • __vbaVarDup.MSVBVM60 ref: 00414253
                • #596.MSVBVM60(?,?,?,?,?,?,?), ref: 0041427B
                • __vbaStrMove.MSVBVM60 ref: 00414286
                • __vbaFreeVarList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 004142B0
                • __vbaFreeStr.MSVBVM60(0041430E), ref: 00414306
                • __vbaFreeStr.MSVBVM60 ref: 0041430B
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$#596CopyListMove
                • String ID: Bibeskftigelsernes
                • API String ID: 2863382718-3164189337
                • Opcode ID: f1306ebebe155f913b7337e95236445280b7ee5ba58acd2cb3276ecfb07596bf
                • Instruction ID: cf2a6df352b7a2408e2cd0f9c57822f96c2577aa2edc696d6cda5b3cc6c8cbbe
                • Opcode Fuzzy Hash: f1306ebebe155f913b7337e95236445280b7ee5ba58acd2cb3276ecfb07596bf
                • Instruction Fuzzy Hash: E941D6B1D01219DFCB14CF99DA44ADEBBB8FB48700F1081AAE20AB7250D7741A49CF94
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaVarTstNe.MSVBVM60(?,?), ref: 004149E5
                • #531.MSVBVM60(Luksusvrelsernes), ref: 004149F5
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00414A0E
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 00414A27
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403930,000001EC), ref: 00414A75
                • __vbaFreeObj.MSVBVM60 ref: 00414A7E
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$#531CheckFreeHresultNew2
                • String ID: 0:|J$Balancegangs8$Luksusvrelsernes
                • API String ID: 1326136531-2358188216
                • Opcode ID: 2f8fa07ad6e58dcd048dd418d02bfabe0bda69e86a997ecbdfe85eb87ea16275
                • Instruction ID: d43980215f9252b666044dc5937a8520ae187cfe97337b76c0d8e586f347c86b
                • Opcode Fuzzy Hash: 2f8fa07ad6e58dcd048dd418d02bfabe0bda69e86a997ecbdfe85eb87ea16275
                • Instruction Fuzzy Hash: F3314DB4A40204ABCB14DF95D989B9EBBB8FB48701F10812AF545B7290D7B85905CF99
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60 ref: 0041BEF6
                • #516.MSVBVM60(00403994), ref: 0041BF01
                • __vbaVarDup.MSVBVM60 ref: 0041BF3D
                • #595.MSVBVM60(?,00000000,?,?,?), ref: 0041BF54
                • __vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 0041BF6C
                • __vbaFreeStr.MSVBVM60(0041BFA2), ref: 0041BF9B
                Strings
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$#516#595CopyList
                • String ID: Udmarvnings8
                • API String ID: 515552688-761385786
                • Opcode ID: a8cae08b05bbf7514a08a44d811b59f318c229fc82d4185ba7e2ae9548f9a3d7
                • Instruction ID: a1827fcd01e8b3dff643e0edb2d23522b860f0cc9d67d15cd411e2b8ee2f13b6
                • Opcode Fuzzy Hash: a8cae08b05bbf7514a08a44d811b59f318c229fc82d4185ba7e2ae9548f9a3d7
                • Instruction Fuzzy Hash: 8521BBB1D01249AFCB04DFD8DA45ADEBBB8EB08705F20812AF506B7254D7745E09CFA5
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • #705.MSVBVM60(?,00000000), ref: 00420174
                • __vbaStrMove.MSVBVM60 ref: 0042017F
                • __vbaFreeVar.MSVBVM60 ref: 00420188
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 004201A1
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 004201BA
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A44,00000208), ref: 004201DD
                • __vbaFreeObj.MSVBVM60 ref: 004201E6
                • __vbaFreeStr.MSVBVM60(00420210), ref: 00420209
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$#705CheckHresultMoveNew2
                • String ID:
                • API String ID: 1968677507-0
                • Opcode ID: 4a9fc5d8e3bce55560015243f8d93377f5504fc0c5385e40ad4ca48ade074294
                • Instruction ID: 8fbcbe67b959c61540109be93ccbe260872d4b727a39f4375688a59a61d9add3
                • Opcode Fuzzy Hash: 4a9fc5d8e3bce55560015243f8d93377f5504fc0c5385e40ad4ca48ade074294
                • Instruction Fuzzy Hash: 71213B74A00215ABCB10DF94DE8DEAEBBB8FB58705F100126F542F71A1DB745945CBA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB03
                • __vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB0B
                • #536.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB1C
                • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB27
                • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB30
                • __vbaFreeStr.MSVBVM60(0041FB5D,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB50
                • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB55
                • __vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 0041FB5A
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$Free$Copy$#536Move
                • String ID:
                • API String ID: 754517999-0
                • Opcode ID: 7fe32ad166b2150e0e799ba2e097945d7697435e1a1f44ee563e646f46d367ee
                • Instruction ID: a9c2eff05225d983cc597aa254edfa74c45209fc47342e7973d1bcb1cb062924
                • Opcode Fuzzy Hash: 7fe32ad166b2150e0e799ba2e097945d7697435e1a1f44ee563e646f46d367ee
                • Instruction Fuzzy Hash: EA11EC71D0020D9FCB04DFA4DA55AEEBBB4FB58700F108126E502B72A4EB346A05CF95
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 004211D7
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 004211F6
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A18,000000F8), ref: 00421219
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 00421232
                • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042124B
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403A54,00000130), ref: 004212DA
                • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004212EA
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckHresultNew2$FreeList
                • String ID:
                • API String ID: 1549294082-0
                • Opcode ID: a02b61fb2adc9b991b6b53ffcbe8f0f1aca2782af4736eb5cb844124cd186282
                • Instruction ID: a12609b69974565226686c311a8d23b42cdf608c26e39f289d6b6387332692b1
                • Opcode Fuzzy Hash: a02b61fb2adc9b991b6b53ffcbe8f0f1aca2782af4736eb5cb844124cd186282
                • Instruction Fuzzy Hash: BB412F74A00204AFCB14DF98D989A9EBBF9FB48700F60846AE905F73A1D6749905CBA5
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(004038E8,00422390,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420EE4
                • __vbaHresultCheckObj.MSVBVM60(00000000,023EEF84,004038D8,00000014,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420F09
                • __vbaHresultCheckObj.MSVBVM60(00000000,?,004038F8,000000B8,?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420F33
                • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004015E6), ref: 00420F3C
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckHresult$FreeNew2
                • String ID:
                • API String ID: 4261391273-0
                • Opcode ID: 986a9876dc30cba5e9f3ee5aee327cefa17eeea4741f9099a4528c7605aed31b
                • Instruction ID: aab996004259524910c2325a4783fff8a6d17f7beace5b2461f49d1d77b309ff
                • Opcode Fuzzy Hash: 986a9876dc30cba5e9f3ee5aee327cefa17eeea4741f9099a4528c7605aed31b
                • Instruction Fuzzy Hash: 7D11BF34A40215BBC710DF54DE8AEABBBFCEB15701F504026F505B32A0C6B8A845CBA8
                Uniqueness

                Uniqueness Score: -1.00%

                APIs
                • __vbaNew2.MSVBVM60(00402540,00422010), ref: 0041C723
                • __vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041C73C
                • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004039A8,000001C4), ref: 0041C75F
                • __vbaFreeObj.MSVBVM60 ref: 0041C768
                Memory Dump Source
                • Source File: 00000001.00000002.592043082.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
                • Associated: 00000001.00000002.592026398.0000000000400000.00000002.00020000.sdmp Download File
                • Associated: 00000001.00000002.592064681.0000000000422000.00000004.00020000.sdmp Download File
                • Associated: 00000001.00000002.592070985.0000000000424000.00000002.00020000.sdmp Download File
                Yara matches
                Similarity
                • API ID: __vba$CheckFreeHresultNew2
                • String ID:
                • API String ID: 1645334062-0
                • Opcode ID: dfa046f8ebe7f311c780645dd621dfdf907c17396fb2411e1e497a918c0d9062
                • Instruction ID: cbe978aa07168c73cedfdd3511af30478e96a46c777a672972c56e894f974253
                • Opcode Fuzzy Hash: dfa046f8ebe7f311c780645dd621dfdf907c17396fb2411e1e497a918c0d9062
                • Instruction Fuzzy Hash: EF018C74680205BBD710AF64CE89FAA7BBCFB08B05F100425F941F72E0E3B85904CAA9
                Uniqueness

                Uniqueness Score: -1.00%